cve.bz

CVE-2025-48924

5.3 mediumEPSS 2.6%

Medium (5.3) in apache commons lang. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.apache.commons:commons-lang3 3.18.0.

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS
2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE
CWE-674
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j288-q9x7-2f5vMavenorg.apache.commons:commons-lang3>=3.0 <3.18.03.18.0
GHSA-j288-q9x7-2f5vMavencommons-lang:commons-lang>=2.0 <=2.6no fix published

References

Check your stackJSON